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Sir: 

We, Alexander Tuzhilin and Ravinarayan Arunkundram, declare as follows: 

1 . We are co-inventors of the above-identified application and at least independent claims 
89, 136 and 154 of the above-identified application, as provided in the accompanying 
Amendment being filed together with this declaration. 

2. The exemplary embodiments of the invention as recited at least in independent claims 
89, 136 and 154, as provided in the accompanying Amendment being filed together with 
this declaration, were conceived by us earlier than September 23, 1997. 

3. A communication from Alexander Tuzhilin to the person at the New York University 
responsible for commercializing inventions at that time (copying Ravinarayan 
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Arunkundram) regarding the exemplary embodiments which include every recitation 
provided at least in such independent claims 89, 136 and 154 (as submitted to the U.S. 
Patent and Trademark Office for this application on July 28, 2008) memorializes that a 
search was done for such exemplary embodiments has a date that is earlier than 
September 23, 1997, a redacted copy of which is attached herewith. 

4. We worked diligently to reduced the invention (that includes every element recited at 
least in independent claims 89, 136 and 154, respectively, as provided in the 
accompanying Amendment being filed together with this declaration) to practice starting 
from before September 23, 1997at least until the filing date of the present application, 
i.e., January 26, 1998. 

5. Such diligence included, but not limited to: 

• Alexander Tuzhilin providing draft disclosure to the person at the New York 
University responsible for commercializing inventions, and considering assigning 
attorney(s) to prepare, file an prosecute patent application(s) for the inventions 
before September 23, 1997, and additional comments on the disclosure on 
September 26, 1997 (a copy of the redacted communication being attached 
herewith); 

• Alexander Tuzhilin providing changes to the draft application to the attorney 
responsible for the application on October 24, 1 997 (a redacted copy of which is 
attached); 
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• inventors' receipt, discussions and/or review of drafts of the application, drawings 
and/or claims therefor provided by the attorney preparing the draft of the application, 
with the drafts thereof being provided to Alexander Tuzhilin (during the period 
between September 23, 1 997 through January 26, 1 998) on the following dates: 

a. November 1 1 , 1 997 ("Date 1 "), 

b. November 1 4, 1 997 ("Date 2"), 

c. November 17, 1997 ("Date 3"), 

d. December 2, 1 997 ("Date 4"), 

e. January 1 0, 1 998 ("Date 5"), 

f. January 15, 1998 ("Date 6"); 

• multiple discussions with the attorney preparing the present application during the 
period at least between November 12, 1997 through January 26, 1998, and shortly 
after each of Dates 1-6; 

• inventors' reviewing and modifying the drafts provided by the attorney preparing the 
draft of the application after most or all of Dates 1-6 (e.g., one such review and 
modification being provided by Alexander Tuzhilin to the attorney on December 2, 

1 997), further reviewing and approving the last draft of the application for filing with 
the U.S. Patent and Trademark Office on January 26, 1998. 

6. We believe that during such period of diligence, no unexplained or unreasonable delays 
have occurred. 

7. The information that described the exemplary embodiments as recited at least in 
independent claims 89, 136 and 154, as provided in the accompanying Amendment 
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being filed together with this declaration, was provided to New York University, Office of 
Industrial Liaison for consideration earlier than September 23, 1 997. 

8. We hereby declare that all statements made herein of our own knowledge are true and 
that all statements made on information and belief are believed to be true; and further 
that these statements were made with the knowledge that willful false statements and 
the like so made are punishable by fine or imprisonment, or both, under Section 1001 of 
Title 18 of the United States Code and such willful false statements may jeopardize the 
validity of the application or any patent issued thereon. 





Date: 



Ravinarayan Arunkundram 
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Date: 
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REDACTED 



Original Message 

From: Alexander Tuzhilin [mailto:atuzhili@stern.nyu.edu] 

Sent : REDACTED 

To: burris@cat.nyu.edu 

Cc: ravi@stern.nyu.edu; atuzhili@stern.nyu.edu 
Subject: third patent 



Jimm, 

we checked the IBM patent database and found nothing that is directly 
related to our Web monitoring patent. How shall we proceed with that patent? 

Alex 
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^exander Tuzhilin and Ravi Arunkundram 



1. introduction 

The Web is a very dynamic and constantly evolving phenomenon: new Web pages are 
constantly created, and old pages are frequently modified. Therefore, it is often very 
difficult to follow all the changes made at different Web sites, especially if you want to 
keep track of the changes made at numerous sites. Even if one can follow simple 
changes, such as addition and deletion of certain keywords at a site, it is much more 
difficult to follow complicated changes and relationships across multiple sites. For 
example, it may be difficult to detect the situation when several companies suddenly 
created links to each other's Web site following an introduction of a new product by one 
of them. Nevertheless, it may be important to be able to detect such changes because 
some of them contain important information about new developments in or among the 
organization (for example, once we detected that the companies started pointing at each 
other's Web sites, it may be an indication that they are forming an alliance, and itmay be 
useful to know that). 

To deal with the problem of monitoring changes at Web sites, some vendors developed 
systems that provide simple monitoring capabilities. For example. 

Unfortunately, Lycos monitoring capabilities are quite simplistic and do not allow 
monitoring more complex relationships, such as the one described above. 

This invention presents a method for monitoring complex changes occurring at one or 
several the Web sites. We believe that it will be useful to a broad range of Web users, 
such as financial analysts, industry analysts, investors, regulatory agencies, and 
advertisers. 

In the next section we describe a monitoring and probing specification language, and in 
Section 3 we explain how this language can be implemented. Finally, in Section 4 we 
will describe its practical embodiments. 



2. Monitoring/Probing Specification Language 

The general structure of a monitoring/probing rule (or a trigger - we use these terms 
interchangeably in this document) is 

WHEN <events> 
IP <conditions> 



THEN <probing-actioiis> 

where events, conditions, and probing-actions are briefly defined as follows (they will be 
described in detail later). 

Event: An event is a change in state of one or more objects that we are monitoring. For 
instance," an appearance or disappearance of one or more keywords, the appearance of a 
new link between two sites, a change in physical attributes of a web page are examples of 
events. 

Conditions: Conditions are constraints that apply to events and act as filters that refine 
the space of events to result in a smaller subset that are of interest to entities that monitor 
the web. For instance, the appearance of the keyword "push technology" is an event that 
is of interest only if the keyword "cable modem" does not exist anywhere on the site (the 
qualifier "only if cable modem does not exist anywhere else" is a condition that is applied 
to the event). 

Probing Action: The purpose of the probing action is to investigate what is "going on" at 
the site or a collection of sites once the events in the WHEN-clause occurred and satisfied 
the conditions in the IF-clause. For instance, the system may explore what is "going on" 
at a predefined list of web sites when the keyword "cable modem" recently appeared in 
one or more of them (if the events and condition specified above hold good). A probing 
action usually returns some information that is the result of the examination of one or 
more web sites in order to understand deeper reasons for the occurrence of events in the 
WHEN-clause and the conditions in the IF-clause. 

The following examples illustrate the structure of WHEN- ff -THEN rules: 

1 . WHEN the Keyword "Cable Modem" Appears on a site 

IF the Keyword "Push Technology" Does not appear at the Site 

THEN Find out on how many sites (from a pre-defined list of sites) the word 

"Cable Modem Appeared" and of these 

how many feature the keyword "Push technology" 

2. IF (Several Web sites are linked into a Star' configuration AND the Keyword "Cable 

Modem" is found on all the nodes in the configuration) 
THEN (Find all such configurations, the members of which contain the word "Cable 
Modem"). 



' '"Star" is 
Sites. 



a user-deflncd predicate, intuitively, meaning (hat (here is a centra? site that is linked t< 



3 IF (A keyword set consisting of {"Push technologies' 1 , "Web TV", "Channels") 
' auoears in all the nodes (members) ofa user-defined configuration) 

TffiN (Find all such configurations where such keywords appeared; return the hst of 
the corresponding URL's). 

4. TF (the number of visits to a site increase at a rate greater than r AND the sites contain 

the keyword set { Cable Modems, Web T V } ) 

THEN (find all sites that contain the same keywords and whose visit rate was greater 
than r; return the set of corresponding URL's). 

5 . IF (a keyword appears at a site AND links to that site from other sites disappear) 
THEN (find all the sites from which links to this site disappeared; 

find if these sites have any keywords in common; 
find all the sites which are now linked to this site; 
find if these sites have any keywords in common; 
return four lists) 



The WHEN- and IF-clauses form the monitoring pari of the rule (trigger), and the 
THEN-clause forms the probing part of the rule. The monitoring part of the trigger 
watches for certain events to occur that satisfy certain conditions. Once the monitor 
detects appropriate events, it does not necessarily informs the user about this for the 
reasons explained below. It tries to explore the situation in which these events occurred 
by executing certain probing actions specified in the probing part of the trigger (i.e. in the 
THEN clause). These probing actions will be described below. The structure of a rule is 
similar to the structure of triggers used in active databases. However, the nature of 
events, conditions and especially probing actions is substantially different, as will be 
explained below. 

An event in the WHEN-clause may be atomic or composite. A composite event is the 
combination of two or more atomic events. One of the most popular niethods to define, 
composite events is through the conjunction of atomic events, i.e. as El and BTa nd ...j 

and En, where El, E2 En are atomic events, such as "link between two sites appears," 

"a keyword appears within a site," or "a page (or link) was deleted." However, composite 
events can be defined in more general, terms as well (e.g. as a Conjunctive or a 
Disjunctive Normal Form (CNF or DNF) of its atomic events). Atomic events belong to 
one of the following classes (but atomic events are not limited just to these classes): 

1 . A link appears/disappears 

2. A Keyword (or a group of Keywords) appears on a page. 

3. A Page's text is modified. 

4. Change in the physical attributes of a page. 

5. A visitor visit a page. 



Although events in the monitoring part of the rule arc useful, it is not necessary to use 
them in general for monitoring Web activities, The reason for that is that they can be 
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Conditions: 



An example of an IP-clause's—- ISlr and . 1 3 ^"re Pi « an atomic condition 

^^.oS^AND^K,^^ ^^jp Keyword exists in 
W « ^ % K ' «*«» » * " a«d "Keyword ™ 

- i-we bp a g ea„d 

5.. ¥««t::Refer S to the act of a visitor (anybody who reaches a Web Site) visiting a site. 

Tn addition to these basic entities, we also use some of the composite entities that can be 
derived from the bas.c entities using some data definition lavage (? 3 

1. Configuration: A collection of Web Sites that are linked to each other. A 



Configuration can have one (trivial case) or more Web Sites. For example, a set of 
sil.es linked in a circular fashion forms a "ring" configuration; or a configuration 
consisting of a central site that is linked to all other sites in the configuration and 
other sites being linked only to the central site, forms a "star" configuration. 
2. Reach relation: It specifies which sites can be reached from a given site. This 
relation can be defined as a transitive closure of the LINKS relation. 

Basic and derived entities are modeled as data objects in the corresponding data model. 
For example, if the data model is relational, then these entities are modeled as relations 
(predicates). If the data model is object-oriented, then they are modeled as data objects. 
Without loss of generality, we assume that the model is relational data model and that we 
model these entities as predicates (using relational terminology, we will sometimes call 
them "relations" or "tables" and assume that these terms are synonyms). For example, 
LINKS is a predicate of the form LINKS(sitel,site2), where site] is the site from which 
the link originates and points to site2. Moreover, some of the predicates are temporal 
because they (implicitly) change over time. For example, predicate LINKS may 
implicitly change over time (because links can be added and removed over time). Note 
that this invention is not limited to the relational data model and is applicable to other 
data models as well. 

Once we defined basic entities of the data model (e.g. as predicates/relations), we specify 
the atomic conditions that can appear in the IF-clause of the monitor as follows. An 
atomic condition can either be a predicate, or its negation, or a past temporal predicate (a 
past temporal predicate is either a temporal predicate preceded by a unary past temporal 
operator or a binary temporal operator). Some examples of unary past temporal operators 
are Always_in_the_past, Sometimes_in_thejpast, 

Sometimes_within_the_past(T_time_units), Always within_the_past(T_time_units), 

and an example of a binary temporal operator is Since. Some examples of atomic' 
conditions are: 

1. Key_Words(site,keyword,count) meaning that the keyword "keyword" has count 
"count" at site "site", 

2. "LINKS(sitcI.site2) Sometimes jwithin_the_past(2weeks)" „ meaning that a link 
existed at some point between sites sitel and sitc2 within the past 2 weeks. Note that 
LINKS is a temporal predicate because it implicitly changes over time. 

3. "Key_Words(XYZ, "cable_modem", count) Since LINKS(XYZ, ABC)" -- meaning 
that the keyword "cable modem" appeared at cite XYZ sine the link was established 
between sites XYZ and ABC. 



Probing Actions 

W 7 hen the monitoring condition of a trigger is satisfied, the user can be notified about this 
event and the monitoring results can be returned to him/her. Unfortunately, these 
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^L a " ^ retUm a PP r °P riate i^rmation detected by the monitor™ 

component of the tnggcr back to the user. For example, the trigger monit0n »S 

IF the keyword "Cable Modem" appears at a site but the keyword "Push 

lecniiology does not appear at that site 
TEEN issue an alarm and return that information to the user 

returns the names of all the sites where the keyword "Cable Modem" appears but not 
the keyword "Push Technology." 

2. Retrieve information cither from the Web site(s) or from the temporal predicates 
maintained at the monitoring site in a way to be described in Section 2. 1 and check if 
it satisfies certain conditions. One way to do this is by formulating SQL or other types 
of temporal or non-temporal queries. For example, assume that in the monitoring pari 
of a trigger it was detected that a certain configuration among a group of sites was 
broken when a certain keyword appeared in one or more of these sites Then in the 
probing part we may want to find the list of all sites whose links to those sites where 
the keyword appeared were deleted after the appearance of the keyword. This probing 
action can be expressed with the following three SQL queries: 

(The first query extracts the list ofall sites that point to one particular site (e g 
w ww.target.com ) ,n the previous monitoring period (before the keyword appeared)). 

SELECT [Web Links Data].[Origin of Link], fWeb Links DataJ.fTarget Site] 

W S ( DS e r b M Lin - S DsXa l^ S ite])= W.target.conV') AND (([Web 
Lmks DataJ.fMomtonng PenodJ^T - 1") AND ((fWeb Links DatajStt) ^ 

* - *T a hnk with that site in the 
current link") *° Pes * 35 a ten W*ry table called "TEMP: Sites with no 



(The third query joins the two temporary tables in an SOT rw~, a 

•hose sites ta have dieted a ft* £ the^em 1^ " "* '* ° f 

SELECT [TEMP; Sites with no current link].[Origin of Link] 

TkiON ^.If ^ ^ i0lN t™*:** with eariier 

SS^nrn WIt * "O^nt lmkj.fOrigin of Link] - [TEMP:sites 
with earlier link].[Ongin of Link] 

GROUP BY [TEMP: Sites with no current HnkJ.fOrigin of Link] 

ORDER BY [TEMP: Sites with no current link]. [Origin of Link]; 

3. Execute a program written in a general-purpose programming language (e g Q that 
examines certain conditions. For example, such program may visit different Web \ites 
in some sequence and return the URLs of those sites that satisfy certain properties 
(e.g. have increasingly higher visitation traffic). 

4. Execute a Data Mining Query ([iVA96], [H+96].,[SOMZ96],[K+94]). A data min.ne 
query discovers all the patterns of a certain type (specified as a set of constraints on 
he types of patterns to be discovered). It is stated in a Data Mining Query Language 

of : rK+94» [ VA , 963 ' DMQL P*** 1 W 3 tSOMZ96], or a7a JJg 

of [K+94]) and returns a set of patterns satisfying this query. For example a data 

1,5 ? 1 correlate appearances and disappearances of the keywords "Cable 
Modem and Push Technologies" across certain specified groups of site*: The 

better ,ns.ght. into the relationship between these terms and, more generally better 
insights into what is "going on" with these two technologies. 

trom Section 2. The THEN-clause of the trigger from Example 5 consists of a sequence 
of 5 operat.ons (that can be defined with operations of type 2 i e ririll. inr q ! 
operations that can be defined, for example, with SQL querLs) ' " mf ° rmat, ° n 

3. Implementation Issues 

£Z°™ kSUe " h ° W 10 ™ PkmOTt < he W <* «■*<«*« bw. described in 
One of the main implementation issues is that Weh ;« ■ i_ 



visits at the site has been monotonicallv increasing within the nasi ? m™, h« i ,u 
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3.1 Information to be Maintained at the Monitoring Site 

store the current values of these nr^J^U Z g ? ' , ™* nS that We need t0 
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temporal operator (e.g. Ahvaysjwst. Sometimes _pa st, etc.) we store an auxiliarv copy of 
the predicate pertaining to this operator. For example, for the temporal expression 
Always jjast UNKS(sitel , site2) appearing in one of the triggers, we siore the current 
copy of LINKS(sitel , sitc2) and an auxiliary predicate AJwaysJPast LTNKS(sitel site? I 
Always_PastJJNKS(sitel, site2) is true if and only if there was always a link from sitel ' 
to srte2 tn the past. Similarly, we store an auxiliary predicate Sometimes_Past LINKS for 
the temporal expression "Sometimes_Past LINKS' 1 . In general we maintain one auxiliary 
operator for every (predicate, temporal operator) pair appearing in one of the monitoring" 
triggers created by the user. These auxiliary predicates can be maintained using the 
methods known to the person having an ordinary skill in the art (e.g. as described in 
[Chom92])': For example, predicate AlwaysJPastJJNKS is updated every monitoring 
period by removing records (sitel , site2) from it that do not appear in the current copy of 
LINKS(sitel, site2). Note that these auxiliary predicates are non-temporal (they only 
simulate temporal predicates but do not have any temporal component as part of their 
structure) and can be stored using the conventional methods known to someone with an 
ordinary skill in the art. 

One of the steps in predicate maintenance is the process of obtaining the current copy of 
the predicate. This means visiting the monitored site(s) and evaluating the present 
conditions of the predicate(s) at that site. One of the central issues in this process is what 
information should be checked and, even more importantly, what information should be 
brought from the monitored site(s) back to the monitoring site. This is a critical issue 
because, we want to monitor many sites and need to minimize the data to be transferred 
back, to the monitoring site in order not to clog the communication lines. We will address 
this issue in the next section. 

3.2 Efficient Methods of Transferring Data to the Monitoring Site 

As was c 'demonstrated in Section 3 . 1, for the monitoring purposes, it is necessary for the 
system to bring back at each monitoring period only the current states of the predicates 
that are maintained at the monitoring site, such as LINKS, Web_Sites, Key_Words, etc 
Given this data, the past temporal predicates can be evaluated using the methods 
described in Section 3.1 (e.g. maintaining LINKS and Always_Past_Links predicates), 

To obtain the current copies of these predicates, the agents should be created that visit the 
sites being monitored and retrieve the corresponding predicates. For example, if we 
monitor LINKS(sitel ,site2), then an agent should go to, site sitel and determine if there is 
a link from that site to site2. Such agents are created at the time of system development 
using the methods known to a person having the ordinary skill in the art and are *not* 
written by the user at the time monitors are specified by him/her. 

An additional optimization issue arises when one can bring less data to the monitoring 
^ than in the current copy of the predicate being monitored. For example, assume that 
t Pr6d,cate bemg monitored in the JF-clause of a trigger is "Always Past 

LtNKS( SI tel, S it e2r . As was explained in Section 3. 1, we canXr3riTSed££ h v 
creatmg an aux.hary predicate Alwa y s_P aS t_LlNKS(sitcl, S ite2). Note Z t ^ 
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Web site being monitored. " } ' the P^'cates are retrieved from the 

r- -TJ^How to Build the Probing Component 

Qt-IESTJON: DO WE NEED THIS SECTION 

Z^^^J^A^*^ supports four types of probitlg 
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4. Practical Embodiments 



We believe that there are two reasons for monitoring .Web site. The first is the obviou, 
d.rec. benefit to be derived from acquiring the information that may be contained in one 
or more web sites. To have access to Urge and distributed information repositories on the 
web ,. nccessao- to know what information resides at a site. Most commercial 
arable search engines, like AltaVista and Yahoo provide this service. There is a second 
reason for monitoring the Web which has to do with the significance tha, user, may 
attach to events that ocur on the Web or Wei E, w , A Web Even, is chmge ;„ 



stale of a web site (or sites) that may have causal implications to users. This when re- 
stated means thai users may find the actual contents of the sites and the navigational 
patterns associated with them (links to other sites) less significant than the change in 
contents or the appearance 01 disappearance of links. We refer to information about such 
changes as meta information. To understand how meta information is of very great value 
to variety of business entities, Investors, Venture Capitalists, Consulting firms, economic 
and financial research agencies, investment bankers and advertisers to name some, 
consider the following example. Let us a consider a microprocessor making firm (say, 
Alpha Corp.) that is in the race for putting more transistors on a chip by using a process 
called Photolithography. This firm is a part of an alliance that has decided that 
Photolithography and associated technologies will be the commercially successful route 
to take in the future. This firm's web site is connected (linked) to the web site of the firms 
that are its alliance partners in this business. A competing technology using high energy 
X-rays is used by another consortium of companies (say Beta Corp.) whose web sites are 
also linked. Analysts and investors in the microprocessor industry, watch developments 
closely in the field and wish to be informed of the alliances between companies that offer 
different technologies. If a new firm or a group of firms start offering a technology based 
on photolithography that complements Alpha Corp.'s products, this information is of 
considerable significance to investors and analysts. They could use our system, 
WebWatch to monitor the appearance of Keywords "photolithography" on the Web. 
Further, they could define the triggers in such a way that WebWatch could identify the 
entry of these new firms into the field and probe further to see if they arc connected to 
Alpha Corp.'s alliance or if these firms have created a competing alliance (by forming an 
inter-linked configuration of sites). Suppose, links to one or more of the firms from Alpha 
corp.'s web configuration were to disappear from the web sites of other firms in the 
configuration, WebWatch could immediately recognize this as an event and probe for 
more details to determine possible causes for the removal of these links. The system's 
probe could identify the following causes: 

(i.) The firms offer a competing technology or are aligned with a competitor: 
WebWatch could look for keywords that indicate that these firms are now 
offering competing products or it could look for links from the sites of Beta 
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that makes most simple monitoring mechanisms less than useful. The second advantage 
is that it allows the user to define a relationship between certain events and their possible 
implications. The occurrence of an event (deletion of a link to a site) may be 
significantly correlated with one phenomenon (addition of a link from different site) but 
may be entirely meaningless in the context of other phenomena (say, spurt in the number 
of visits to the site). Web Watch allows the user to define triggers that make an explicit 
connection between what is symptomatic event and what needs be further investigated. 
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General description section 



don't warn; to monitor 



1. Overview of the main idea 
the idea of monitoring changes to Web sites; 
overview 

what will be described in the rest of the document. 

2. Monitoring specification language 

a. monitoring component -- the IF clans* (say that < 

decidenr t r d rtnS: es - °° when *«« while <*■—•» « 

b. probing component - 4 parts: data mining queries, SOL querios ^vent 
state changes return digcovr-d info (or notification) back to to useT 

3. Implementation 

a. Maintaining history — explain why important (statelessness of Internet) - 
Problem: given the set of monitors, what needs to be si'-orod In Intyrnet) ' 
?l+V\t° W to sto.ee this information (what are the data structures) and 
how often this information needs to be bought back 

tha t* ?Tl^ttf;i 0n isaues: how to bri "<? back a *min.tnmal* amount of data 
Sfk to'oir 3 :!?^ 102 ™ lto ' in « — <*• *^ 'what- needs to be bought 

to do Jhi^^fth^h^fi? 11 C \ a - bC b u OUQht baGk 1:0 the 3ite - Laun <* ™ agent 
«™,°« * . o at inC °n<«fJ-on this agent should be provided before i«- 

«sr^° t s*^j2:, m ' - £ »-"°» —« - to 



